Problem
You want to control PowerShell’s security features in an enterprise setting.
Solution
To manage PowerShell’s security features enterprisewide:
- Apply PowerShell’s Group Policy templates to control PowerShell’s execution policy through Group Policy.
- Deploy Microsoft Certificate Services to automatically generate Authenticode codesigning certificates for domain accounts.
- Apply software restriction policies to prevent PowerShell from trusting specific script publishers.
Discussion
Apply PowerShell’s Group Policy templates
The administrative templates for Windows PowerShell let you override the machine’s local execution policy preference at both the machine and peruser level. To obtain the PowerShell administrative templates, visit http://www.microsoft.com/ downloads and search for “Administrative templates for Windows PowerShell.”
Although Group Policy settings override local preferences, PowerShell’s execution policy should not be considered a security measure that protects the system from the user. It is a security measure that
helps prevent untrusted scripts from running on the system. As mentioned in the introduction, PowerShell is only a vehicle that allows users to do what they already have the Windows permissions to do.
Once you install the administrative templates for Windows PowerShell, launch the Group Policy Object Editor MMC snapin. Rightclick Administrative Templates and then select Add/Remove Administrative Templates. You will find the administrative template in the installation location you chose when you installed the administrative templates for Windows PowerShell. Once added, the Group Policy Editor MMC snapin provides PowerShell as option under its Administrative Templates node.
The default state is Not Configured. In this state, PowerShell takes its execution pol icy from the machine’s local preference. If you change the state to one of the Enabled options (or Disabled), PowerShell uses this configuration instead of the machine’s local preference.
PowerShell respects these Group Policy settings no matter what. This includes settings that the machine’s administrator may consider to reduce security—such as an Unrestricted group policy overriding an
AllSigned local preference.
Peruser Group Policy settings override the machine’s local preference, while permachine Group Policy settings override peruser settings.
Deploy Microsoft Certificate services
Although outside the scope of this book, Microsoft Certificate Services lets you automatically deploy codesigning certificates to any or all domain users. This provides a significant benefit, as it helps protect users from accidental or malicious script tampering.
For an introduction to this topic, visit http://technet.microsoft.com and search for “Enterprise Design for Certificate Services.”
Apply software restriction policies
While not common, you may sometimes want to prevent PowerShell from running scripts signed by specific publishers. If the script would normally be subject to signature verification (for example, it is a remote script, or PowerShell’s execution policy is set to AllSigned), PowerShell lets you configure this through certificate rules in the computer’s software restriction policies.
PowerShell does not support software restriction policy path rules.
To configure these certificate rules, launch the Local Security Policy MMC snapin listed in the Administrative Tools group of the Start menu. Expand the Software Restriction Policies node, rightclick Additional Rules, and then select New Certificate Rule.
Browse to the certificate that represents the publisher you want to block, and then click OK to block that publisher.
You can also create certificate policy that allows only certificates from a centrally administered whitelist. To do this, select either Allow only all administrators to manage Trusted Publishers or Allow only enterprise administrators to manage Trusted Publishers from the Trusted Publishers Management dialog.
